[PING] Two OOB read vulnerabilities in bfd/xcofflink.c — requesting CVE assignment

[The mist·CJM]

Hi maintainers,


I hope this message finds you well.


I recently reported two separate heap-buffer-overflow (OOB read)
vulnerabilities in bfd/xcofflink.c to security@sourceware.org,
with detailed analyses and PoCs attached:


1.OOB read at xcofflink.c:1919 (xcoff_link_add_symbols,
   csects[] out-of-bounds access)


2. OOB read at xcofflink.c:2282 (xcoff_link_add_symbols, r_symndx
   out-of-bounds access)


These are two distinct issues with different root causes, both in
xcoff_link_add_symbols but at different code paths.


I'm writing to the list as a gentle follow-up to check if anyone has
had a chance to look at these. I would be grateful for any confirmation
on whether they qualify for CVE assignment.


If any additional information or revised PoCs are needed, I'm happy
to provide them.


Thank you for your time and for maintaining Binutils.


Best regards,
Chen Zhenzhe
Hangzhou Dianzi University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/binutils/attachments/20260227/92d3ec45/attachment-0001.htm>